iOS 18 beta: fetch Savage ticket error

[iFred09]

Hello,

I have an error when trying to update my iPhone to iOS 18 beta with the latest build of idevicerestore.

Found device in Normal mode
ECID: 626314411458588
Identified device as d83ap, iPhone16,1
Device Product Version: 18.0
Device Product Build: 22A5282m
Extracting BuildManifest from IPSW
IPSW Product Version: 18.0
IPSW Product Build: 22A5297f Major: 22
Device supports Image4: true
Variant: Developer Upgrade Install (IPSW)
This restore will update the device without erasing user data.
Checking IPSW for required components...
All required components found in IPSW
Checking if device requires stashbag...
Device requires stashbag.
******************************************************************************
* Please enter your passcode on the device.  The device will store a token   *
* that will be used after restore to access the user data partition.  This   *
* prevents an 'Attempting data recovery' process occurring after reboot that *
* may take a long time to complete and will _also_ require the passcode.     *
******************************************************************************
Stashbag created.
Getting ApNonce in normal mode... 20 6c ce 39 c5 bf 11 b1 a1 e7 3c f9 af f7 f4 9c 0d 69 be 9d 8e 84 48 f2 10 d8 3b 68 ee 6e 3d ab
Trying to fetch new SHSH blob
Getting SepNonce in normal mode... fe a3 1c ab da 63 7e a2 8d 4f 76 2b d7 27 16 9d 48 e6 7a ce
Received SHSH blobs
Committing stashbag...
Stashbag committed!
Entering recovery mode...
INFO: device serial number is N7HNW73FCY
Extracting iBEC.d83.RELEASE.im4p (Firmware/dfu/iBEC.d83.RELEASE.im4p)...
Personalizing IMG4 component iBEC...
Sending iBEC (1579239 bytes)...
Recovery Mode Environment:
iBoot build-version=iBoot-11881.0.193.0.1
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting applelogo@2556~iphone.im4p (Firmware/all_flash/applelogo@2556~iphone.im4p)...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (29262 bytes)...
Extracting h16x_ane_fw_iaso_d8x.im4p (Firmware/ane/h16x_ane_fw_iaso_d8x.im4p)...
Personalizing IMG4 component ANE...
Sending ANE (1632115 bytes)...
Extracting aopfw-iphone16aop.RELEASE.im4p (Firmware/AOP/aopfw-iphone16aop.RELEASE.im4p)...
Personalizing IMG4 component AOP...
Sending AOP (3209075 bytes)...
Extracting AppleAVE2FW_H16.im4p (Firmware/ave/AppleAVE2FW_H16.im4p)...
Personalizing IMG4 component AVE...
Sending AVE (1546027 bytes)...
Extracting sptm.t8122.release.im4p (Firmware/sptm.t8122.release.im4p)...
Personalizing IMG4 component Ap,RestoreSecurePageTableMonitor...
Sending Ap,RestoreSecurePageTableMonitor (155901 bytes)...
Extracting txm.iphoneos.release.im4p (Firmware/txm.iphoneos.release.im4p)...
Personalizing IMG4 component Ap,RestoreTrustedExecutionMonitor...
Sending Ap,RestoreTrustedExecutionMonitor (156044 bytes)...
Extracting armfw_g16p.im4p (Firmware/agx/armfw_g16p.im4p)...
Personalizing IMG4 component GFX...
Sending GFX (4212955 bytes)...
Extracting adc-aceso-d8x.im4p (Firmware/isp_bni/adc-aceso-d8x.im4p)...
Personalizing IMG4 component ISP...
Sending ISP (25388918 bytes)...
Extracting D83_MtpFirmware.im4p (Firmware/D83_MtpFirmware.im4p)...
Personalizing IMG4 component MtpFirmware...
Sending MtpFirmware (6878237 bytes)...
Extracting t8130pmp.im4p (Firmware/pmp/t8130pmp.im4p)...
Personalizing IMG4 component PMP...
Sending PMP (661363 bytes)...
Extracting rans.t8130.release.im4p (Firmware/rans.t8130.release.im4p)...
Personalizing IMG4 component RestoreANS...
Sending RestoreANS (1045142 bytes)...
Extracting t8130dcp_restore.im4p (Firmware/dcp/t8130dcp_restore.im4p)...
Personalizing IMG4 component RestoreDCP...
Sending RestoreDCP (6080371 bytes)...
Extracting 090-27884-079.dmg.trustcache (Firmware/090-27884-079.dmg.trustcache)...
Personalizing IMG4 component RestoreTrustCache...
Sending RestoreTrustCache (17424 bytes)...
Extracting SmartIOFirmware_ASCv6.im4p (Firmware/SmartIOFirmware_ASCv6.im4p)...
Personalizing IMG4 component SIO...
Sending SIO (1163375 bytes)...
Extracting WirelessPower.iphone16.im4p (Firmware/WirelessPower/WirelessPower.iphone16.im4p)...
Personalizing IMG4 component WCHFirmwareUpdater...
Sending WCHFirmwareUpdater (225869 bytes)...
Extracting iBootData.d83.RELEASE.im4p (Firmware/all_flash/iBootData.d83.RELEASE.im4p)...
Personalizing IMG4 component iBootData...
Sending iBootData (10337 bytes)...
ramdisk-size=0x20000000
Extracting 090-27884-079.dmg (090-27884-079.dmg)...
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (157296502 bytes)...
Extracting DeviceTree.d83ap.im4p (Firmware/all_flash/DeviceTree.d83ap.im4p)...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (66487 bytes)...
Extracting sep-firmware.d83.RELEASE.im4p (Firmware/all_flash/sep-firmware.d83.RELEASE.im4p)...
Personalizing IMG4 component RestoreSEP...
Sending RestoreSEP (7058445 bytes)...
Extracting kernelcache.release.iphone16 (kernelcache.release.iphone16)...
Personalizing IMG4 component RestoreKernelCache...
Sending RestoreKernelCache (18797996 bytes)...
Waiting for device to enter restore mode...
About to restore device...
Connecting now...
Connected to com.apple.mobile.restored, version 15
Device 00008130-000239A13003401C has successfully entered restore mode
Hardware Information:
BoardID: 4
ChipID: 33072
UniqueChipID: 626314411458588
ProductionMode: true
Starting Reverse Proxy
ReverseProxy[Ctrl]: (status=1) Ready
Checkpoint completed id: 0x655 (is_host_compatible) result=0
Checkpoint started   id: 0x604 (set_weight_from_options)
Checkpoint completed id: 0x604 (set_weight_from_options) result=0
Checkpoint started   id: 0x68F (libauthinstall_callback)
Checkpoint completed id: 0x68F (libauthinstall_callback) result=0
Checkpoint started   id: 0x608 (device_has_hoover)
Checkpoint completed id: 0x608 (device_has_hoover) result=0
Checkpoint started   id: 0x60B (update_ticket)
About to send RootTicket...
Sending RootTicket now...
Done sending RootTicket
Checkpoint completed id: 0x60B (update_ticket) result=0
Checkpoint started   id: 0x60D (wait_for_storage)
Waiting for NAND (28)
Checkpoint completed id: 0x60D (wait_for_storage) result=0
Checkpoint started   id: 0x60E (update_NAND_firmware)
Updating NAND Firmware (58)
Checkpoint completed id: 0x60E (update_NAND_firmware) result=0
Checkpoint started   id: 0x60F (clear_remap_variable)
Checkpoint completed id: 0x60F (clear_remap_variable) result=0
Checkpoint started   id: 0x65C (print_nvram_variables)
Checkpoint completed id: 0x65C (print_nvram_variables) result=0
Checkpoint started   id: 0x610 (asp_nand_set_writable)
Checkpoint completed id: 0x610 (asp_nand_set_writable) result=0
Checkpoint started   id: 0x613 (find_filesystem_partitions)
Checkpoint completed id: 0x613 (find_filesystem_partitions) result=0
Checkpoint started   id: 0x67E (verify_storage_for_update)
Checkpoint completed id: 0x67E (verify_storage_for_update) result=0
Checkpoint started   id: 0x609 (load_sep_os)
About to send NORData...
Found firmware path Firmware/all_flash
Getting firmware manifest from build identity
Extracting LLB.d83.RELEASE.im4p (Firmware/all_flash/LLB.d83.RELEASE.im4p)...
Personalizing IMG4 component LLB...
Extracting ansf.t8130.release.im4p (Firmware/ansf.t8130.release.im4p)...
Personalizing IMG4 component ANS...
Extracting d83-boot-chime.im4p (Firmware/embeddedaudioresources/image4/d83-boot-chime.im4p)...
Personalizing IMG4 component Ap,AudioBootChime...
Extracting AppleLPM.d83.release.im4p (Firmware/AppleLPM/AppleLPM.d83.release.im4p)...
Personalizing IMG4 component Ap,LowPowerMode...
Extracting applelogo@2556~iphone.im4p (Firmware/all_flash/applelogo@2556~iphone.im4p)...
Personalizing IMG4 component AppleLogo...
Extracting DeviceTree.d83ap.im4p (Firmware/all_flash/DeviceTree.d83ap.im4p)...
Personalizing IMG4 component DeviceTree...
Extracting liquiddetect@2556~iphone-USBc.im4p (Firmware/all_flash/liquiddetect@2556~iphone-USBc.im4p)...
Personalizing IMG4 component Liquid...
Extracting recoverymode@2556~iphone-USBc.im4p (Firmware/all_flash/recoverymode@2556~iphone-USBc.im4p)...
Personalizing IMG4 component RecoveryMode...
Extracting WirelessPower.iphone16.im4p (Firmware/WirelessPower/WirelessPower.iphone16.im4p)...
Personalizing IMG4 component WCHFirmwareUpdater...
Extracting iBoot.d83.RELEASE.im4p (Firmware/all_flash/iBoot.d83.RELEASE.im4p)...
Personalizing IMG4 component iBoot...
Extracting sep-firmware.d83.RELEASE.im4p (Firmware/all_flash/sep-firmware.d83.RELEASE.im4p)...
Personalizing IMG4 component RestoreSEP...
Extracting sep-firmware.d83.RELEASE.im4p (Firmware/all_flash/sep-firmware.d83.RELEASE.im4p)...
Personalizing IMG4 component SEP...
Extracting sep-patches.d83.im4p (Firmware/all_flash/sep-patches.d83.im4p)...
Personalizing IMG4 component SepStage1...
Sending NORData now...
Done sending NORData
Checkpoint completed id: 0x609 (load_sep_os) result=0
Checkpoint started   id: 0x693 (preload_keys_for_fsck)
Checkpoint completed id: 0x693 (preload_keys_for_fsck) result=0
Checkpoint started   id: 0x665 (fsck_filesystems)
Unmounting filesystems (29)
Checking filesystems (15)
Checkpoint completed id: 0x665 (fsck_filesystems) result=0
Checkpoint started   id: 0x614 (mount_system_partition)
Checkpoint completed id: 0x614 (mount_system_partition) result=0
Checkpoint started   id: 0x696 (fix_cache_delete)
Checkpoint completed id: 0x696 (fix_cache_delete) result=0
Checkpoint started   id: 0x65D (delete_mobilebackups)
Checkpoint completed id: 0x65D (delete_mobilebackups) result=0
Checkpoint started   id: 0x6C1 (clean_update_volume)
Checkpoint completed id: 0x6C1 (clean_update_volume) result=0
Checkpoint started   id: 0x6A3 (space_checks)
About to send BuildIdentity Dict...
Sending BuildIdentityDict now...
Done sending BuildIdentityDict
Checkpoint completed id: 0x6A3 (space_checks) result=0
Checkpoint started   id: 0x69F (clear_mobile_gestalt_cache)
Checkpoint completed id: 0x69F (clear_mobile_gestalt_cache) result=0
Checkpoint started   id: 0x654 (read_previous_os_build_version)
Checkpoint completed id: 0x654 (read_previous_os_build_version) result=0
Checkpoint started   id: 0x697 (downgrade_check)
Checkpoint completed id: 0x697 (downgrade_check) result=0
Checkpoint started   id: 0x615 (copy_hardware_info)
Checkpoint completed id: 0x615 (copy_hardware_info) result=0
Checkpoint started   id: 0x616 (fdr_create)
About to send FDR Trust data...
Sending FDR Trust data now...
Done sending FDR Trust Data
Checkpoint completed id: 0x616 (fdr_create) result=0
Checkpoint started   id: 0x617 (fdr_save_data)
Checkpoint completed id: 0x617 (fdr_save_data) result=0
Checkpoint started   id: 0x618 (store_baseband_migration)
Checkpoint completed id: 0x618 (store_baseband_migration) result=0
Checkpoint started   id: 0x619 (check_for_restore_log)
Checking for uncollected logs (44)
Checkpoint completed id: 0x619 (check_for_restore_log) result=0
Checkpoint started   id: 0x61A (check_for_ota_logs)
Checking for uncollected logs (44)
Checkpoint completed id: 0x61A (check_for_ota_logs) result=0
Checkpoint started   id: 0x61B (submit_update_stats)
ReverseProxy[Ctrl]: (status=3) Connect Request
ReverseProxy[Conn]: (status=1) Ready
ReverseProxy[Conn]: (status=2) Terminated
Checkpoint completed id: 0x61B (submit_update_stats) result=0
Checkpoint started   id: 0x661 (read_persistent_files)
Checkpoint completed id: 0x661 (read_persistent_files) result=0
Checkpoint started   id: 0x61D (unmount_unconditionally)
Unmounting filesystems (29)
Unmounting filesystems (29)
Unmounting filesystems (29)
Unmounting filesystems (29)
Unmounting filesystems (29)
Checkpoint completed id: 0x61D (unmount_unconditionally) result=0
Checkpoint started   id: 0x64E (clean_nand)
Checkpoint completed id: 0x64E (clean_nand) result=0
Checkpoint started   id: 0x61F (format_effaceable_storage)
Checkpoint completed id: 0x61F (format_effaceable_storage) result=0
Checkpoint started   id: 0x68A (format_ean_storage)
Checkpoint completed id: 0x68A (format_ean_storage) result=0
Checkpoint started   id: 0x677 (perform_main_os_prepare)
Checkpoint started   id: 0x660 (update_partitions_for_apfs)
Checkpoint completed id: 0x660 (update_partitions_for_apfs) result=0
Checkpoint started   id: 0x622 (reload_filesystem_partitions)
Checkpoint completed id: 0x622 (reload_filesystem_partitions) result=0
Checkpoint started   id: 0x160D (delete_recovery_partition)
Resizing Main Filesystem Partition (68)
Checkpoint completed id: 0x160D (delete_recovery_partition) result=0
Checkpoint started   id: 0x658 (format_media)
Creating filesystem (12)
Checkpoint completed id: 0x658 (format_media) result=0
Checkpoint started   id: 0x659 (find_volumes_after_format)
Checkpoint completed id: 0x659 (find_volumes_after_format) result=0
Checkpoint started   id: 0x6B3 (prepare_for_system_image)
Checkpoint completed id: 0x6B3 (prepare_for_system_image) result=0
Checkpoint started   id: 0x65B (restore_system_image)
Checkpoint completed id: 0x65B (restore_system_image) result=0
Checkpoint started   id: 0x65A (baseband_migration_data)
Checkpoint completed id: 0x65A (baseband_migration_data) result=0
Checkpoint started   id: 0x675 (init_gigalocker)
About to send filesystem...
Connected to ASR
Validating the filesystem
Filesystem validated
Sending filesystem now...
Restoring image (13)
Requesting URLAsset from https://wkms-public.apple.com/fcs-keys/emS2Z48W5hiK6-9wCuih_4olLWp2NLZ3KfK8zPHASvM=
Connecting to URLAsset data port 49171
Checkpoint completed id: 0x675 (init_gigalocker) result=0
Checkpoint started   id: 0x68C (init_permanent_update_volume)
Checkpoint completed id: 0x68C (init_permanent_update_volume) result=0
Checkpoint started   id: 0x626 (mount_filesystem)
Mounting filesystems (16)
Mounting filesystems (16)
Mounting filesystems (16)
Checkpoint completed id: 0x626 (mount_filesystem) result=0
Checkpoint started   id: 0x662 (write_persistent_files)
Checkpoint completed id: 0x662 (write_persistent_files) result=0
Checkpoint completed id: 0x677 (perform_main_os_prepare) result=0
Checkpoint started   id: 0x67A (perform_short_prepare)
Checkpoint completed id: 0x67A (perform_short_prepare) result=0
Checkpoint started   id: 0x67B (perform_restore_installing)
Checkpoint started   id: 0x627 (fdr_restore_saved_data)
Checkpoint completed id: 0x627 (fdr_restore_saved_data) result=0
Checkpoint started   id: 0x69A (update_device_firmware_pre_fdr)
Checkpoint started   id: 0x130C (update_aht)
Checkpoint completed id: 0x130C (update_aht) result=0
Checkpoint completed id: 0x69A (update_device_firmware_pre_fdr) result=0
Checkpoint started   id: 0x69B (fdr_prepare)
Checkpoint completed id: 0x69B (fdr_prepare) result=0
Checkpoint started   id: 0x652 (clear_fips_data_file)
Checkpoint completed id: 0x652 (clear_fips_data_file) result=0
Checkpoint started   id: 0x634 (fdr_recover)
Checkpoint completed id: 0x634 (fdr_recover) result=0
Checkpoint started   id: 0x67D (fdr_auto_challenge_claim)
Checkpoint completed id: 0x67D (fdr_auto_challenge_claim) result=0
Checkpoint started   id: 0x635 (update_device_firmware)
Checkpoint started   id: 0x1311 (update_veridian)
Updating Veridian (66)
Checkpoint completed id: 0x1311 (update_veridian) result=0
Checkpoint started   id: 0x1300 (update_iBoot)
Unknown operation (80)
Found IsiBootEANFirmware component DCP
Sending IsiBootEANFirmware image list
Extracting t8130dcp.im4p (Firmware/dcp/t8130dcp.im4p)...
Personalizing IMG4 component DCP...
Sending IsiBootEANFirmware for DCP...
About to send BuildIdentity Dict...
Sending BuildIdentityDict now...
Done sending BuildIdentityDict
About to send BMU,FirmwareMap...
Sending BMU,FirmwareMap now (333288 bytes)
Done sending BMU,FirmwareMap
Sending Veridian TSS request...
Received Veridian ticket
Extracting FirmwareMap.plist (Firmware/Veridian/X2833/FirmwareMap.plist)...
Sending FirmwareResponse data now...
Done sending FirmwareUpdater data
Sending IsiBootNonEssentialFirmware image list
Restoring image (13)
[=                                                 ]   1.0%Flashing firmware (18)
Updating Veridian (66)
Flashing firmware (18)
[==================================================] 100.0%
Checkpoint completed id: 0x1300 (update_iBoot) result=0
Checkpoint started   id: 0x1312 (update_ean)
Unknown operation (80)
Sending IsEarlyAccessFirmware image list
Found IsiBootEANFirmware component DCP
Sending IsiBootEANFirmware image list
Extracting t8130dcp.im4p (Firmware/dcp/t8130dcp.im4p)...
Personalizing IMG4 component DCP...
Sending IsiBootEANFirmware for DCP...
Sending IsiBootNonEssentialFirmware image list
Checkpoint completed id: 0x1312 (update_ean) result=0
Checkpoint started   id: 0x130A (install_fud)
Requesting FUD data (36)
Found IsFUDFirmware component ANE
Found IsFUDFirmware component AOP
Found IsFUDFirmware component AVE
Found IsFUDFirmware component Ap,HapticAssets
Found IsFUDFirmware component Ap,SecurePageTableMonitor
Found IsFUDFirmware component Ap,SystemVolumeCanonicalMetadata
Found IsFUDFirmware component Ap,TrustedExecutionMonitor
Found IsFUDFirmware component GFX
Found IsFUDFirmware component ISP
Found IsFUDFirmware component LeapHaptics
Found IsFUDFirmware component MtpFirmware
Found IsFUDFirmware component Multitouch
Found IsFUDFirmware component PMP
Found IsFUDFirmware component RestoreANS
Found IsFUDFirmware component RestoreTrustCache
Found IsFUDFirmware component SIO
Found IsFUDFirmware component StaticTrustCache
Found IsFUDFirmware component SystemVolume
Found IsFUDFirmware component iBootData
Sending IsFUDFirmware image list
Extracting h16x_ane_fw_iaso_d8x.im4p (Firmware/ane/h16x_ane_fw_iaso_d8x.im4p)...
Personalizing IMG4 component ANE...
Sending IsFUDFirmware for ANE...
Extracting aopfw-iphone16aop.RELEASE.im4p (Firmware/AOP/aopfw-iphone16aop.RELEASE.im4p)...
ERROR: zip_fread: Firmware/AOP/aopfw-iphone16aop.RELEASE.im4p
ERROR: Unable to extract aopfw-iphone16aop.RELEASE.im4p from iPhone16,1_18.0_22A5297f_Restore.ipsw
ERROR: Unable to extract component: AOP
Sending IsFUDFirmware for AOP...
Extracting AppleAVE2FW_H16.im4p (Firmware/ave/AppleAVE2FW_H16.im4p)...
Personalizing IMG4 component AVE...
Sending IsFUDFirmware for AVE...
Extracting D83_HapticAssets.im4p (Firmware/D83_HapticAssets.im4p)...
Personalizing IMG4 component Ap,HapticAssets...
Sending IsFUDFirmware for Ap,HapticAssets...
Extracting sptm.t8122.release.im4p (Firmware/sptm.t8122.release.im4p)...
Personalizing IMG4 component Ap,SecurePageTableMonitor...
Sending IsFUDFirmware for Ap,SecurePageTableMonitor...
Extracting 090-28430-044.dmg.aea.mtree (Firmware/090-28430-044.dmg.aea.mtree)...
Personalizing IMG4 component Ap,SystemVolumeCanonicalMetadata...
Sending IsFUDFirmware for Ap,SystemVolumeCanonicalMetadata...
Restoring image (13)
[=                                                 ]   2.0%Requesting FUD data (36)
Extracting txm.iphoneos.release.im4p (Firmware/txm.iphoneos.release.im4p)...
Personalizing IMG4 component Ap,TrustedExecutionMonitor...
Sending IsFUDFirmware for Ap,TrustedExecutionMonitor...
Extracting armfw_g16p.im4p (Firmware/agx/armfw_g16p.im4p)...
Personalizing IMG4 component GFX...
Sending IsFUDFirmware for GFX...
Extracting adc-aceso-d8x.im4p (Firmware/isp_bni/adc-aceso-d8x.im4p)...
Personalizing IMG4 component ISP...
Sending IsFUDFirmware for ISP...
Extracting D83_LeapHapticsFirmware.im4p (Firmware/D83_LeapHapticsFirmware.im4p)...
Personalizing IMG4 component LeapHaptics...
Sending IsFUDFirmware for LeapHaptics...
Extracting D83_MtpFirmware.im4p (Firmware/D83_MtpFirmware.im4p)...
Personalizing IMG4 component MtpFirmware...
Sending IsFUDFirmware for MtpFirmware...
Extracting D83_Multitouch.im4p (Firmware/D83_Multitouch.im4p)...
Personalizing IMG4 component Multitouch...
Sending IsFUDFirmware for Multitouch...
Extracting t8130pmp.im4p (Firmware/pmp/t8130pmp.im4p)...
Personalizing IMG4 component PMP...
Sending IsFUDFirmware for PMP...
Extracting rans.t8130.release.im4p (Firmware/rans.t8130.release.im4p)...
Personalizing IMG4 component RestoreANS...
Sending IsFUDFirmware for RestoreANS...
Extracting 090-27884-079.dmg.trustcache (Firmware/090-27884-079.dmg.trustcache)...
Personalizing IMG4 component RestoreTrustCache...
Sending IsFUDFirmware for RestoreTrustCache...
Extracting SmartIOFirmware_ASCv6.im4p (Firmware/SmartIOFirmware_ASCv6.im4p)...
Personalizing IMG4 component SIO...
Sending IsFUDFirmware for SIO...
Restoring image (13)
[==                                                ]   3.0%Requesting FUD data (36)
Extracting 090-28430-044.dmg.aea.trustcache (Firmware/090-28430-044.dmg.aea.trustcache)...
Personalizing IMG4 component StaticTrustCache...
Sending IsFUDFirmware for StaticTrustCache...
Extracting 090-28430-044.dmg.aea.root_hash (Firmware/090-28430-044.dmg.aea.root_hash)...
Personalizing IMG4 component SystemVolume...
Sending IsFUDFirmware for SystemVolume...
Extracting iBootData.d83.RELEASE.im4p (Firmware/all_flash/iBootData.d83.RELEASE.im4p)...
Personalizing IMG4 component iBootData...
Sending IsFUDFirmware for iBootData...
Checkpoint completed id: 0x130A (install_fud) result=0
Checkpoint started   id: 0x1304 (update_stockholm)
Updating Stockholm (55)
Checkpoint completed id: 0x1304 (update_stockholm) result=0
Checkpoint started   id: 0x1303 (update_baseband_legacy)
Checkpoint completed id: 0x1303 (update_baseband_legacy) result=0
Checkpoint started   id: 0x1310 (update_rose)
Checkpoint completed id: 0x1310 (update_rose) result=0
Checkpoint started   id: 0x1309 (update_se)
Checkpoint completed id: 0x1309 (update_se) result=0
Checkpoint started   id: 0x1322 (update_vinyl)
Checkpoint completed id: 0x1322 (update_vinyl) result=0
Checkpoint started   id: 0x1301 (update_gas_gauge)
Updating gas gauge software (47)
Checkpoint completed id: 0x1301 (update_gas_gauge) result=0
Checkpoint started   id: 0x1302 (update_ir_mcu)
Updating gas gauge software (47)
Checkpoint completed id: 0x1302 (update_ir_mcu) result=0
Checkpoint started   id: 0x130C (update_aht)
Requesting FUD data (36)
Found IsFUDFirmware component ANE
Found IsFUDFirmware component AOP
Found IsFUDFirmware component AVE
Found IsFUDFirmware component Ap,HapticAssets
Found IsFUDFirmware component Ap,SecurePageTableMonitor
Found IsFUDFirmware component Ap,SystemVolumeCanonicalMetadata
Found IsFUDFirmware component Ap,TrustedExecutionMonitor
Found IsFUDFirmware component GFX
Found IsFUDFirmware component ISP
Found IsFUDFirmware component LeapHaptics
Found IsFUDFirmware component MtpFirmware
Found IsFUDFirmware component Multitouch
Found IsFUDFirmware component PMP
Found IsFUDFirmware component RestoreANS
Found IsFUDFirmware component RestoreTrustCache
Found IsFUDFirmware component SIO
Found IsFUDFirmware component StaticTrustCache
Found IsFUDFirmware component SystemVolume
Found IsFUDFirmware component iBootData
Sending IsFUDFirmware image list
Extracting 090-28430-044.dmg.aea.mtree (Firmware/090-28430-044.dmg.aea.mtree)...
Personalizing IMG4 component Ap,SystemVolumeCanonicalMetadata...
Sending IsFUDFirmware for Ap,SystemVolumeCanonicalMetadata...
Extracting rans.t8130.release.im4p (Firmware/rans.t8130.release.im4p)...
Personalizing IMG4 component RestoreANS...
Sending IsFUDFirmware for RestoreANS...
Extracting 090-27884-079.dmg.trustcache (Firmware/090-27884-079.dmg.trustcache)...
Personalizing IMG4 component RestoreTrustCache...
Sending IsFUDFirmware for RestoreTrustCache...
Extracting 090-28430-044.dmg.aea.root_hash (Firmware/090-28430-044.dmg.aea.root_hash)...
Personalizing IMG4 component SystemVolume...
Sending IsFUDFirmware for SystemVolume...
Checkpoint completed id: 0x130C (update_aht) result=0
Checkpoint started   id: 0x1306 (update_tcon)
Checkpoint completed id: 0x1306 (update_tcon) result=0
Checkpoint started   id: 0x1307 (update_orion)
Checkpoint completed id: 0x1307 (update_orion) result=0
Checkpoint started   id: 0x1308 (update_madea)
Checkpoint completed id: 0x1308 (update_madea) result=0
Checkpoint started   id: 0x130E (update_peppy)
Checkpoint completed id: 0x130E (update_peppy) result=0
Checkpoint started   id: 0x130F (update_nitrogen)
Checkpoint completed id: 0x130F (update_nitrogen) result=0
Checkpoint started   id: 0x130B (update_usbc)
Checkpoint completed id: 0x130B (update_usbc) result=0
Checkpoint started   id: 0x131F (update_canary)
Checkpoint completed id: 0x131F (update_canary) result=0
Checkpoint started   id: 0x130D (update_savage)
Updating Savage (60)
Sending ReceiptManifest data now...
Done sending ReceiptManifest data
About to send BuildIdentity Dict...
Sending BuildIdentityDict now...
Done sending BuildIdentityDict
About to send Savage,BA-Prod-Patch...
Sending Savage,BA-Prod-Patch now (114 bytes)
Done sending Savage,BA-Prod-Patch
About to send Savage,BE-Prod-Patch...
Sending Savage,BE-Prod-Patch now (514 bytes)
Done sending Savage,BE-Prod-Patch
Sending Savage TSS request...
ERROR: Unable to fetch Savage ticket
ERROR: restore_send_firmware_updater_data: Couldn't get Savage firmware data
ERROR: Unable to send FirmwareUpdater data
ERROR: Unable to successfully restore device
ERROR: Unable to send data to ASR. Sent 0 of 131072 bytes.
Unable to send filesystem payload chunk, retrying...
ERROR: Unable to send data to ASR. Sent 0 of 131072 bytes.
Unable to send filesystem payload chunk, retrying...
ReverseProxy[Ctrl]: (status=2) Terminated
ERROR: Unable to restore device```

[nikias]

Can you run with -dd? We want to see the TSS request that is failing.

[iFred09]

here it is :

Sending BuildIdentityDict now...
Done sending BuildIdentityDict
restore_handle_data_request_msg: type = SourceBootObjectV4
DEBUG: restore_send_source_boot_object_v4: Got SourceBootObjectV4 request:
printing 438 bytes plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>MsgType</key>
	<string>DataRequestMsg</string>
	<key>DataType</key>
	<string>SourceBootObjectV4</string>
	<key>Arguments</key>
	<dict>
		<key>ImageName</key>
		<string>Savage,BA-Prod-Patch</string>
		<key>IsRecoveryOS</key>
		<false/>
	</dict>
</dict>
</plist>
About to send Savage,BA-Prod-Patch...
DEBUG: tss_response_get_path_by_entry: No entry 'Savage,BA-Prod-Patch' in TSS response
NOTE: No path for component Savage,BA-Prod-Patch in TSS, will fetch from build identity
Sending Savage,BA-Prod-Patch now (114 bytes)
Done sending Savage,BA-Prod-Patch
restore_handle_data_request_msg: type = SourceBootObjectV4
DEBUG: restore_send_source_boot_object_v4: Got SourceBootObjectV4 request:
printing 438 bytes plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>MsgType</key>
	<string>DataRequestMsg</string>
	<key>DataType</key>
	<string>SourceBootObjectV4</string>
	<key>Arguments</key>
	<dict>
		<key>ImageName</key>
		<string>Savage,BE-Prod-Patch</string>
		<key>IsRecoveryOS</key>
		<false/>
	</dict>
</dict>
</plist>
About to send Savage,BE-Prod-Patch...
DEBUG: tss_response_get_path_by_entry: No entry 'Savage,BE-Prod-Patch' in TSS response
NOTE: No path for component Savage,BE-Prod-Patch in TSS, will fetch from build identity
Sending Savage,BE-Prod-Patch now (514 bytes)
Done sending Savage,BE-Prod-Patch
restore_handle_data_request_msg: type = FirmwareUpdaterData
DEBUG: restore_send_firmware_updater_data: Got FirmwareUpdaterData request:
printing 2327 bytes plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>MsgType</key>
	<string>DataRequestMsg</string>
	<key>DataType</key>
	<string>FirmwareUpdaterData</string>
	<key>Arguments</key>
	<dict>
		<key>MessageArgInfo</key>
		<dict>
			<key>Savage,UID</key>
			<data>
			VG6atnsF6uTaVbX5z915dg==
			</data>
			<key>Savage,AllowOfflineBoot</key>
			<true/>
			<key>Savage,ChipID</key>
			<data>
			AAAAAQ==
			</data>
			<key>Savage,ProductionMode</key>
			<true/>
			<key>Savage,Revision</key>
			<data>
			rAs=
			</data>
			<key>Savage,ReadFWKey</key>
			<true/>
			<key>Savage,ReadECKey</key>
			<true/>
			<key>Savage,Nonce</key>
			<data>
			6Qe2n2AIQXK/JH5/Ja0srw==
			</data>
		</dict>
		<key>MessageArgUpdaterLoopCount</key>
		<integer>0</integer>
		<key>DataChunkSize</key>
		<integer>262144</integer>
		<key>MessageForceRepersonalization</key>
		<true/>
		<key>MessageArgType</key>
		<string>FirmwareResponseData</string>
		<key>DeviceGeneratedTags</key>
		<dict>
			<key>BuildIdentityTags</key>
			<array>
				<string>Savage,ChipID</string>
				<string>Savage,PatchEpoch</string>
				<string>Savage,BA-Prod-Patch</string>
				<string>Savage,BE-Prod-Patch</string>
			</array>
			<key>ResponseTags</key>
			<array>
				<string>Savage,Ticket</string>
			</array>
		</dict>
		<key>DeviceGeneratedRequest</key>
		<dict>
			<key>Savage,UID</key>
			<data>
			VG6atnsF6uTaVbX5z915dg==
			</data>
			<key>Savage,ChipID</key>
			<integer>1</integer>
			<key>SEP</key>
			<dict>
				<key>Digest</key>
				<data>
				hkkPa5qjmulj8Qm3Z104XyJCLX+PtcUyuK+u9gMjy9Ib
				0z+R5b30uxBxJzoES7xM
				</data>
			</dict>
			<key>Savage,ReadFWKey</key>
			<true/>
			<key>Savage,AllowOfflineBoot</key>
			<true/>
			<key>Savage,ProductionMode</key>
			<true/>
			<key>Savage,BA-Prod-Patch</key>
			<dict>
				<key>Digest</key>
				<data>
				JUdhikubFbeoejbGuI6NoqGGkwzJtZY6OhnfquDqnt8=
				</data>
			</dict>
			<key>Savage,PatchEpoch</key>
			<integer>0</integer>
			<key>@Savage,Ticket</key>
			<true/>
			<key>Savage,ReadECKey</key>
			<true/>
			<key>Savage,Nonce</key>
			<data>
			6Qe2n2AIQXK/JH5/Ja0srw==
			</data>
		</dict>
		<key>MessageArgUpdaterName</key>
		<string>Savage</string>
	</dict>
</dict>
</plist>
NOTE: Unable to find BbCalibrationManifestKeyHash node
NOTE: Unable to find BbFactoryActivationManifestKeyHash node
NOTE: Unable to find BbSkeyId node
DEBUG: restore_get_savage_firmware_data: using Savage,BA-Prod-Patch
Sending Savage TSS request...
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>@HostPlatformInfo</key>
	<string>mac</string>
	<key>@VersionInfo</key>
	<string>libauthinstall-973.40.2</string>
	<key>@UUID</key>
	<string>570D7840-D5A0-0EDE-9A50-580638CB9825</string>
	<key>@BBTicket</key>
	<true/>
	<key>@Savage,Ticket</key>
	<true/>
	<key>Savage,UID</key>
	<data>
	VG6atnsF6uTaVbX5z915dg==
	</data>
	<key>SEP</key>
	<dict>
		<key>Digest</key>
		<data>
		hkkPa5qjmulj8Qm3Z104XyJCLX+PtcUyuK+u9gMjy9Ib0z+R5b30uxBxJzoE
		S7xM
		</data>
	</dict>
	<key>Savage,PatchEpoch</key>
	<integer>0</integer>
	<key>Savage,ChipID</key>
	<integer>16777216</integer>
	<key>Savage,AllowOfflineBoot</key>
	<true/>
	<key>Savage,ReadFWKey</key>
	<true/>
	<key>Savage,ProductionMode</key>
	<true/>
	<key>Savage,BA-Prod-Patch</key>
	<dict>
		<key>Digest</key>
		<data>
		JUdhikubFbeoejbGuI6NoqGGkwzJtZY6OhnfquDqnt8=
		</data>
	</dict>
	<key>Savage,Nonce</key>
	<data>
	6Qe2n2AIQXK/JH5/Ja0srw==
	</data>
	<key>Savage,ReadECKey</key>
	<true/>
</dict>
</plist>
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... * Host gs.apple.com:443 was resolved.
* IPv6: (none)
* IPv4: 17.111.103.15
*   Trying 17.111.103.15:443...
* Connected to gs.apple.com (17.111.103.15) port 443
* ALPN: curl offers h2,http/1.1
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256 / [blank] / UNDEF
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: CN=gs.apple.com; O=Apple Inc.; ST=California; C=US
*  start date: Mar 26 21:44:58 2024 GMT
*  expire date: Apr 25 21:44:57 2025 GMT
*  subjectAltName: host "gs.apple.com" matched cert's "gs.apple.com"
*  issuer: CN=Apple Server Authentication CA; OU=Certification Authority; O=Apple Inc.; C=US
*  SSL certificate verify ok.
* using HTTP/1.x
> POST /TSS/controller?action=2 HTTP/1.1
Host: gs.apple.com
User-Agent: InetURL/1.0
Accept: */*
Cache-Control: no-cache
Content-type: text/xml; charset="utf-8"
Content-Length: 1130

< HTTP/1.1 200
< Server: Apple
< Date: Tue, 25 Jun 2024 18:18:06 GMT
< Content-Type: text/html
< Content-Length: 69
< Connection: keep-alive
< Host: gs.apple.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains
< X-Frame-Options: SAMEORIGIN
<
* Connection #0 to host gs.apple.com left intact
TSS server returned: STATUS=94&MESSAGE=This device isn't eligible for the requested build.
ERROR: TSS request failed (status=94, message=This device isn't eligible for the requested build.)
ERROR: Unable to fetch Savage ticket
ERROR: restore_send_firmware_updater_data: Couldn't get Savage firmware data
ERROR: Unable to send FirmwareUpdater data
ERROR: Unable to successfully restore device
ERROR: Unable to send data to ASR. Sent 107784 of 131072 bytes.
Unable to send filesystem payload chunk, retrying...
ERROR: Unable to send data to ASR. Sent 0 of 131072 bytes.
Unable to send filesystem payload chunk, retrying...
No data to read (timeout)
ReverseProxy[Ctrl]: Terminating
ReverseProxy[Ctrl]: (status=2) Terminated
ERROR: Unable to restore device

[nikias]

I pushed a commit that will use the DeviceGeneratedRequest to work around this problem for now.